jinja[invalid] due to executing a lookup plugin that fails because a file does not exist (unsurprising)

[felixfontein]

Summary

Since yesterday's 25.6.0 release the community.internal_test_utils CI fails (https://github.com/ansible-collections/community.internal_test_tools/actions/runs/15724397090/job/44311360568):

jinja[invalid]: The 'file' lookup had an issue accessing the file '/tmp/ansible.pem'. file not found, use -vvvvv to see paths searched
tests/integration/targets/prepare_http_tests/tasks/default.yml:60 Task/Handler: FreeBSD - Add cacert to root certificate store

Read documentation for instructions on how to ignore specific rule violations.

# Rule Violation Summary

  1 jinja profile:basic tags:formatting

Failed: 1 failure(s), 0 warning(s) on 122 files. Last profile that met the validation criteria was 'min'.

The task in question is:

- name: FreeBSD - Add cacert to root certificate store
  ansible.builtin.blockinfile:
    path: "/etc/ssl/cert.pem"
    block: "{{ lookup('file', '/tmp/ansible.pem') }}"
    mode: "0644"
  when: ansible_os_family == 'FreeBSD'

Apparently ansible-lint executes the lookup plugin, which unsurprisingly fails if /tmp/ansible.pem does not exist (which is not surprising since it is created by other tasks).

Issue Type

• Bug Report

OS / ENVIRONMENT

Python 3.13
Latest ansible-lint version from PyPI
Latest ansible-core version from PyPI

Successfully installed MarkupSafe-3.0.2 ansible-compat-25.5.0 ansible-core-2.18.6 ansible-lint-25.6.0 attrs-25.3.0 black-25.1.0 bracex-2.5.post1 cffi-1.17.1 click-8.2.1 cryptography-45.0.4 filelock-3.18.0 importlib-metadata-8.7.0 jinja2-3.1.6 jsonschema-4.24.0 jsonschema-specifications-2025.4.1 mypy-extensions-1.1.0 packaging-25.0 pathspec-0.12.1 platformdirs-4.3.8 pycparser-2.22 pyyaml-6.0.2 referencing-0.36.2 resolvelib-1.0.1 rpds-py-0.25.1 ruamel.yaml-0.18.14 ruamel.yaml.clib-0.2.12 subprocess-tee-0.4.2 wcmatch-10.0 yamllint-1.37.1 zipp-3.23.0

[StopMotionCuber]

I'd like to chime in here, having an issue that's related to this since the latest release. As opposed to this reported issues, for us the file does actually exist.

It's reporting

jinja[invalid]: The 'file' lookup had an issue accessing the file 'files/certificates/acme_account.key'. file not found, use -vvvvv to see paths searched

but the file $ANSIBLE_ROOT/files/certificates/acme_account.key does actually exist. The jinja[invalid] is warning is raised from a role, located at roles/certificate/tasks/certificate_files.yml.

Additionally I tried debugging this issue by issuing an ansible-lint -vvvvv roles/certificate/tasks/certificate_files.yml but I didn't actually find some output related to the search paths searched.

[alisonlhart]

@felixfontein Thanks so much for raising this. We're looking into this.

[CoderJoshDK]

For me, the error went away with #4650. However, my error was a ever so slightly different situation. Feel free to retest with the latest 25.6.1

[felixfontein]

#3650 also fixed the issue for me. I'm not sure whether this should stay open or not since the underlying problem (code execution) isn't solved, that's up to the maintainers to decide.